Drop the version marker from proxy tokens and keys

Tokens for generation 1 and above are now `<gen>.<mac>`. The dot still
keeps them apart from the 43-character original token. The HKDF labels
and signed messages carry the key's purpose instead of a version:
the tenant key uses salt `void-proxy-token`, info `proxy-token`, and
signs `void-proxy-token:<projectId>:<gen>`; the proxy internal key uses
salt `void-proxy-internal`, info `proxy-internal`, and signs
`void-proxy-internal\n<route>\n<projectId>`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Brooooooklyn

platform/packages/api/src/proxy-token.ts

@@ -8,8 +8,9 @@ import { isProjectId } from './id.ts';
  *
  * - legacy (generation 0): base64url(HMAC-SHA256(JWT_SECRET, projectId)),
  *   43 characters, the bytes `hmacSignState` produces;
- * - `v2.<gen>.<mac>`: the MAC is HMAC-SHA256 under a key derived from
- *   JWT_SECRET with HKDF, over the project id and the generation.
+ * - `<gen>.<mac>` (generation 1 and above): the MAC is HMAC-SHA256 under a
+ *   key derived from JWT_SECRET with HKDF, over the project id and the
+ *   generation. The dot keeps it apart from the 43-character legacy token.
  *
  * ROUTING `proxy-token:<projectId>` holds the accept floor `{"gen": F}`. A
  * token is accepted when its MAC is valid and its generation is at least F.
@@ -143,20 +144,26 @@ async function hkdfHmacKey(secret: string, salt: string, info: string): Promise<
   );
 }
 
+// JWT_SECRET signs login JWTs, OAuth/link state and the legacy token as a raw
+// HMAC key. The two keys below are HKDF outputs with their own salt and info,
+// so they differ from that raw key and from each other: a tenant token never
+// verifies as a proxy internal value, and neither verifies as any raw-key MAC.
 function proxyTokenKey(secret: string): Promise<CryptoKey> {
-  return cachedKey(proxyTokenKeys, secret, () => hkdfHmacKey(secret, 'void-proxy-token', 'v2'));
+  return cachedKey(proxyTokenKeys, secret, () =>
+    hkdfHmacKey(secret, 'void-proxy-token', 'proxy-token'),
+  );
 }
 
 function proxyInternalKey(secret: string): Promise<CryptoKey> {
   return cachedKey(proxyInternalKeys, secret, () =>
-    hkdfHmacKey(secret, 'void-proxy-internal', 'v1'),
+    hkdfHmacKey(secret, 'void-proxy-internal', 'proxy-internal'),
   );
 }
 
 // --- Encoding ---
 
 const MAC = /^[A-Za-z0-9_-]{43}$/;
-const V2_TOKEN = /^v2\.([1-9][0-9]{0,15})\.([A-Za-z0-9_-]{43})$/;
+const GENERATION_TOKEN = /^([1-9][0-9]{0,15})\.([A-Za-z0-9_-]{43})$/;
 
 function encodeBase64url(bytes: ArrayBuffer): string {
   let binary = '';
@@ -181,7 +188,7 @@ async function verify(key: Promise<CryptoKey>, message: string, mac: string): Pr
 }
 
 function proxyTokenMessage(projectId: string, gen: number): string {
-  return `void-proxy-token:v2:${projectId}:${gen}`;
+  return `void-proxy-token:${projectId}:${gen}`;
 }
 
 // --- Tenant tokens ---
@@ -201,7 +208,7 @@ export async function deriveProxyToken(
   if (gen === 0) {
     return sign(legacyKey(jwtSecret), projectId);
   }
-  return `v2.${gen}.${await sign(proxyTokenKey(jwtSecret), proxyTokenMessage(projectId, gen))}`;
+  return `${gen}.${await sign(proxyTokenKey(jwtSecret), proxyTokenMessage(projectId, gen))}`;
 }
 
 /** The token's generation when its MAC is valid for `projectId`, else null. No I/O. */
@@ -216,7 +223,7 @@ export async function proxyTokenGeneration(
   if (MAC.test(token)) {
     return (await verify(legacyKey(jwtSecret), projectId, token)) ? 0 : null;
   }
-  const match = V2_TOKEN.exec(token);
+  const match = GENERATION_TOKEN.exec(token);
   if (!match) {
     return null;
   }
@@ -343,7 +350,7 @@ export const PROXY_INTERNAL_AUTH_HEADER = 'x-void-proxy-internal';
 export type ProxyInternalRoute = 'resolve-worker' | 'resolve-resource' | 'verify-prerender-build';
 
 function proxyInternalMessage(route: ProxyInternalRoute, projectId: string): string {
-  return `void-proxy-internal:v1\n${route}\n${projectId}`;
+  return `void-proxy-internal\n${route}\n${projectId}`;
 }
 
 /**

platform/packages/api/test/integration/api-internal-project-token.test.ts

@@ -216,7 +216,7 @@ describe('project token generations', () => {
     expect(run).not.toHaveBeenCalled();
   });
 
-  it('accepts the legacy and v2 tokens at /internal/revalidate while no floor is set', async () => {
+  it('accepts the legacy and generation 1 tokens at /internal/revalidate while no floor is set', async () => {
     const project = await liveProject();
     for (const gen of [0, 1]) {
       const response = await internalRequest(

platform/packages/api/test/unit/proxy-token.test.ts

@@ -30,12 +30,12 @@ const PROJECT = 'proj_000000000001';
 const OTHER_PROJECT = 'proj_000000000002';
 
 const TOK_0 = 'ZMRzpVRsaOJSG_unVlA0oqSaz2kApOohvao_XGR8Q0c';
-const TOK_1 = 'v2.1.3W5_i2g79pUCXyzxWPQWmTqscSNtC_2vuHC84z775Y8';
-const TOK_2 = 'v2.2.Vx_qycCHPx2BoYvQrbQ7JrhbONKU7f0jNK23B0YUhOs';
+const TOK_1 = '1.tSB1ya3fUJXjnL2nfUht0aCBRh9d1pFCrH_rJIJGGWo';
+const TOK_2 = '2.Ko4ZEz_VQ8IZH70koONArHkURyEHZUwLJsqFsGJgwyE';
 const INTERNAL: Record<ProxyInternalRoute, string> = {
-  'resolve-worker': 'fSljhl8vCcBSR-jWXklS-KDL4K8lFb_wPaRAu-aKPv0',
-  'resolve-resource': 'gNOx85Zh_di7yHFjG8AlV0QQ8PbHYs1ipC2ukAl7i5Y',
-  'verify-prerender-build': 'A7F1IjLUbEWq0atQH3W5dsR1DidJ6ZgqU6QQ3lehBbc',
+  'resolve-worker': 'Phjba6joMrR31HPBsOamhNdtbT3__9Fg6zkd34dJiS0',
+  'resolve-resource': 'qqnenNPCqY-C4RMAfPn0AUdXlvKS0tvkDcC8lyjTYck',
+  'verify-prerender-build': 'L-_KXs8KdULytY5ibjHuH095R-1L3OM91NokMoj6828',
 };
 const ROUTES = Object.keys(INTERNAL) as Array<ProxyInternalRoute>;
 
@@ -47,15 +47,15 @@ function nodeTok(gen: number, projectId = PROJECT): string {
   if (gen === 0) {
     return base64url(createHmac('sha256', SECRET).update(projectId).digest());
   }
-  const key = Buffer.from(hkdfSync('sha256', SECRET, 'void-proxy-token', 'v2', 32));
-  const mac = createHmac('sha256', key).update(`void-proxy-token:v2:${projectId}:${gen}`).digest();
-  return `v2.${gen}.${base64url(mac)}`;
+  const key = Buffer.from(hkdfSync('sha256', SECRET, 'void-proxy-token', 'proxy-token', 32));
+  const mac = createHmac('sha256', key).update(`void-proxy-token:${projectId}:${gen}`).digest();
+  return `${gen}.${base64url(mac)}`;
 }
 
 function nodeInternal(route: ProxyInternalRoute, projectId = PROJECT): string {
-  const key = Buffer.from(hkdfSync('sha256', SECRET, 'void-proxy-internal', 'v1', 32));
+  const key = Buffer.from(hkdfSync('sha256', SECRET, 'void-proxy-internal', 'proxy-internal', 32));
   return base64url(
-    createHmac('sha256', key).update(`void-proxy-internal:v1\n${route}\n${projectId}`).digest(),
+    createHmac('sha256', key).update(`void-proxy-internal\n${route}\n${projectId}`).digest(),
   );
 }
 
@@ -111,7 +111,7 @@ describe('vectors', () => {
   });
 
   it('keeps internal values distinct from each other and from tenant tokens', () => {
-    const values = [...Object.values(INTERNAL), TOK_0, TOK_1.slice('v2.1.'.length)];
+    const values = [...Object.values(INTERNAL), TOK_0, TOK_1.slice('1.'.length)];
     expect(new Set(values).size).toBe(values.length);
   });
 
@@ -193,7 +193,7 @@ describe('state table', () => {
 });
 
 describe('verifyProxyToken', () => {
-  it('accepts legacy and v2 tokens when no floor is set', async () => {
+  it('accepts the legacy and generation tokens when no floor is set', async () => {
     expect(await verify(TOK_0).result).toBe(true);
     expect(await verify(TOK_1).result).toBe(true);
   });
@@ -218,14 +218,14 @@ describe('verifyProxyToken', () => {
   });
 
   it('rejects a MAC relabelled with another generation', async () => {
-    const relabelled = `v2.2.${TOK_1.slice('v2.1.'.length)}`;
+    const relabelled = `2.${TOK_1.slice('1.'.length)}`;
     const { result, readState } = verify(relabelled);
     expect(await result).toBe(false);
     expect(readState).not.toHaveBeenCalled();
   });
 
   it('rejects a bad MAC without reading the floor', async () => {
-    const badMac = `v2.1.${'A'.repeat(43)}`;
+    const badMac = `1.${'A'.repeat(43)}`;
     for (const token of [badMac, 'A'.repeat(43)]) {
       const { result, readState } = verify(token);
       expect(await result).toBe(false);
@@ -234,14 +234,15 @@ describe('verifyProxyToken', () => {
   });
 
   it.each([
-    ['leading zero generation', `v2.01.${TOK_1.slice('v2.1.'.length)}`],
-    ['leading zero and short MAC', 'v2.01.x'],
+    ['generation zero in the dotted form', `0.${TOK_1.slice('1.'.length)}`],
+    ['leading zero generation', `01.${TOK_1.slice('1.'.length)}`],
+    ['leading zero and short MAC', '01.x'],
     ['42-char MAC', TOK_0.slice(0, 42)],
     ['44-char MAC', `${TOK_0}A`],
     ['trailing padding', `${TOK_0}=`],
     ['standard base64 alphabet', `+${TOK_0.slice(1)}`],
     ['empty token', ''],
-    ['unsafe generation', `v2.9999999999999999.${TOK_1.slice('v2.1.'.length)}`],
+    ['unsafe generation', `9999999999999999.${TOK_1.slice('1.'.length)}`],
   ])('rejects a malformed token (%s) without reading the floor', async (_name, token) => {
     const { result, readState } = verify(token);
     expect(await result).toBe(false);
@@ -416,7 +417,7 @@ describe('verifyProxyInternalAuth', () => {
   it.each([
     ['42 chars', INTERNAL['resolve-worker'].slice(0, 42)],
     ['44 chars', `${INTERNAL['resolve-worker']}A`],
-    ['a v2 token shape', 'v2.1.x'],
+    ['a generation token shape', '1.x'],
     ['a tenant token', TOK_1],
     ['the legacy token', TOK_0],
     ['empty', ''],

platform/packages/proxy/README.md

@@ -47,10 +47,10 @@ seconds; non-email routes return 413 for oversized bodies and 408 for timeouts.
 Each deployed Worker holds its project token in the `__VOID_PROXY_TOKEN`
 binding. Both forms are derived from `JWT_SECRET`:
 
-| Form             | Generation | Value                                                                                                                                                 |
-| ---------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Legacy           | 0          | base64url `HMAC-SHA256(JWT_SECRET, projectId)`                                                                                                        |
-| `v2.<gen>.<mac>` | `<gen>`    | `<mac>` = base64url `HMAC-SHA256(K, "void-proxy-token:v2:" + projectId + ":" + gen)`, `K` = HKDF of `JWT_SECRET` (salt `void-proxy-token`, info `v2`) |
+| Form          | Generation | Value                                                                                                                                                       |
+| ------------- | ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Legacy        | 0          | base64url `HMAC-SHA256(JWT_SECRET, projectId)`                                                                                                              |
+| `<gen>.<mac>` | 1 and up   | `<mac>` = base64url `HMAC-SHA256(K, "void-proxy-token:" + projectId + ":" + gen)`, `K` = HKDF of `JWT_SECRET` (salt `void-proxy-token`, info `proxy-token`) |
 
 The ROUTING key `proxy-token:{projectId}` holds the project's accept floor,
 `{"gen": N}`. A token is accepted when its MAC is valid and its generation is at
@@ -73,8 +73,8 @@ generation. It never sends a generation above the issued one.
 
 The proxy authenticates its own `resolve-worker`, `resolve-resource`, and
 `verify-prerender-build` calls with `x-void-proxy-internal`, an HMAC under a
-separate HKDF key (salt `void-proxy-internal`, info `v1`) bound to the route and
-project. That value never leaves the platform. The proxy also sends the legacy
+separate HKDF key (salt `void-proxy-internal`, info `proxy-internal`) bound to
+the route and project. That value never leaves the platform. The proxy also sends the legacy
 `x-void-internal` header so an older API keeps working.
 
 ## Endpoints

platform/packages/proxy/test/unit/proxy.test.ts

@@ -1153,7 +1153,7 @@ describe('proxy worker', () => {
       vi.restoreAllMocks();
     });
 
-    it('accepts the legacy and v2 tokens while no floor is set', async () => {
+    it('accepts the legacy and generation 1 tokens while no floor is set', async () => {
       for (const gen of [0, 1]) {
         clearProxyTokenStateCache();
         const env = createEnv();